> I wonder how long it would have taken Microsoft to respond to a similar situation.

When ASP.NET's AES implementation was exposed to automated attack recently, the DevDiv guys got out in front of the issue with a workaround in about four days:

http://weblogs.asp.net/scottgu/archive/2010/09/18/important-...

Then, they continued to stay on top of it, providing guidance until a real patch was available:

http://weblogs.asp.net/scottgu/archive/2010/09/20/frequently...

http://weblogs.asp.net/scottgu/archive/2010/09/24/update-on-...

http://weblogs.asp.net/scottgu/archive/2010/09/27/asp-net-se...

http://weblogs.asp.net/scottgu/archive/2010/09/28/asp-net-se...

http://weblogs.asp.net/scottgu/archive/2010/09/30/asp-net-se...